#pragma once

#include <ntddk.h>
#include <windef.h>
#include <intrin.h>

#include "..\KernelHiddenExecute\DebugPrintEx.h"
#include "..\KernelHiddenExecute\SectionOperation.h"

//////////////////////////////////////////////////////////////////////////
//constants and macros

#define TARGET_DRV_NAME	L"\\Driver\\KernelHiddenExecute"
#define SECTION_NAME_HIDDEN_INSTRUCTIONS	".hi"
#define SECTION_NAME_NORMAL_INSTRUCTIONS	".text"
#define SECTION_NAME_HIDDEN_DATA			".hd"
#define SECTION_NAME_NORMAL_DATA			".data"

//////////////////////////////////////////////////////////////////////////
//prototypes

NTSTATUS ObReferenceObjectByName
(
	PUNICODE_STRING ObjectName,
	ULONG Attributes,
	PACCESS_STATE AccessState,
	ACCESS_MASK DesiredAccess,
	POBJECT_TYPE ObjectType,
	KPROCESSOR_MODE AccessMode,
	PVOID ParseContext,
	PVOID* Object
);
extern POBJECT_TYPE* IoDriverObjectType;

//modify WD bit in the CR0
VOID WriteEnable();
VOID WriteDisable();

//KMP
VOID cal_next(PCHAR str, PLONG_PTR next, LONG_PTR len);
PVOID KMP(PVOID str, LONG_PTR slen, PVOID ptr, LONG_PTR plen);

//attack
BOOL AttackCodeAndData(PDRIVER_OBJECT pDrvObj, PCHAR pSegName, PCHAR pPattern, SIZE_T len1, PCHAR pFake, SIZE_T len2);
NTSTATUS AttackDemoDriver(BOOL restore);
